The vulnerability CVE-2025-49254 affects thembay Nika versions up to 1.2.8 and is characterized by improper control of the filename used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can lead to execution of arbitrary local files. The CVSS 3.1 score of 8.1 reflects a high-severity issue with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available from the vendor or other sources. The vulnerability is published and tracked but has no known active exploitation.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full compromise of confidentiality, integrity, and availability of the system running thembay Nika. This can result in unauthorized data access, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, users should monitor thembay's official channels for updates. Until a fix is available, restricting access to the vulnerable application and minimizing exposure to untrusted users may reduce risk.